CVE WatchAug 11, 2026

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does n

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 11, 2026 · Last modified: Aug 11, 2026 · CWE-843

EPSS · 30d

Not enough EPSS history yet.

Technical description

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-688117.8 HIG

—

———Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.6h CVE-2026-688037.8 HIG

—

———Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.6h CVE-2026-658078.8 HIG

—

———Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.6h CVE-2026-649047.8 HIG

—

———Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.6h CVE-2026-619327.8 HIG

—

———Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.6h CVE-2026-14644—

14.4%

——4Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.4d